1 /*
2  * Copyright (C) 2008 The Android Open Source Project
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  *  * Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  *  * Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in
12  *    the documentation and/or other materials provided with the
13  *    distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19  * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #include "system_properties/contexts_split.h"
30 
31 #include <ctype.h>
32 #include <limits.h>
33 #include <stdlib.h>
34 #include <string.h>
35 #include <sys/stat.h>
36 
37 #include <async_safe/log.h>
38 
39 #include "system_properties/context_node.h"
40 #include "system_properties/system_properties.h"
41 
42 class ContextListNode : public ContextNode {
43  public:
ContextListNode(ContextListNode * next,const char * context,const char * filename)44   ContextListNode(ContextListNode* next, const char* context, const char* filename)
45       : ContextNode(strdup(context), filename), next(next) {
46   }
47 
~ContextListNode()48   ~ContextListNode() {
49     free(const_cast<char*>(context()));
50   }
51 
52   ContextListNode* next;
53 };
54 
55 struct PrefixNode {
PrefixNodePrefixNode56   PrefixNode(struct PrefixNode* next, const char* prefix, ContextListNode* context)
57       : prefix(strdup(prefix)), prefix_len(strlen(prefix)), context(context), next(next) {
58   }
~PrefixNodePrefixNode59   ~PrefixNode() {
60     free(prefix);
61   }
62   char* prefix;
63   const size_t prefix_len;
64   ContextListNode* context;
65   PrefixNode* next;
66 };
67 
68 template <typename List, typename... Args>
ListAdd(List ** list,Args...args)69 static inline void ListAdd(List** list, Args... args) {
70   *list = new List(*list, args...);
71 }
72 
ListAddAfterLen(PrefixNode ** list,const char * prefix,ContextListNode * context)73 static void ListAddAfterLen(PrefixNode** list, const char* prefix, ContextListNode* context) {
74   size_t prefix_len = strlen(prefix);
75 
76   auto next_list = list;
77 
78   while (*next_list) {
79     if ((*next_list)->prefix_len < prefix_len || (*next_list)->prefix[0] == '*') {
80       ListAdd(next_list, prefix, context);
81       return;
82     }
83     next_list = &(*next_list)->next;
84   }
85   ListAdd(next_list, prefix, context);
86 }
87 
88 template <typename List, typename Func>
ListForEach(List * list,Func func)89 static void ListForEach(List* list, Func func) {
90   while (list) {
91     func(list);
92     list = list->next;
93   }
94 }
95 
96 template <typename List, typename Func>
ListFind(List * list,Func func)97 static List* ListFind(List* list, Func func) {
98   while (list) {
99     if (func(list)) {
100       return list;
101     }
102     list = list->next;
103   }
104   return nullptr;
105 }
106 
107 template <typename List>
ListFree(List ** list)108 static void ListFree(List** list) {
109   while (*list) {
110     auto old_list = *list;
111     *list = old_list->next;
112     delete old_list;
113   }
114 }
115 
116 // The below two functions are duplicated from label_support.c in libselinux.
117 
118 // The read_spec_entries and read_spec_entry functions may be used to
119 // replace sscanf to read entries from spec files. The file and
120 // property services now use these.
121 
122 // Read an entry from a spec file (e.g. file_contexts)
read_spec_entry(char ** entry,char ** ptr,int * len)123 static inline int read_spec_entry(char** entry, char** ptr, int* len) {
124   *entry = nullptr;
125   char* tmp_buf = nullptr;
126 
127   while (isspace(**ptr) && **ptr != '\0') (*ptr)++;
128 
129   tmp_buf = *ptr;
130   *len = 0;
131 
132   while (!isspace(**ptr) && **ptr != '\0') {
133     (*ptr)++;
134     (*len)++;
135   }
136 
137   if (*len) {
138     *entry = strndup(tmp_buf, *len);
139     if (!*entry) return -1;
140   }
141 
142   return 0;
143 }
144 
145 // line_buf - Buffer containing the spec entries .
146 // num_args - The number of spec parameter entries to process.
147 // ...      - A 'char **spec_entry' for each parameter.
148 // returns  - The number of items processed.
149 //
150 // This function calls read_spec_entry() to do the actual string processing.
read_spec_entries(char * line_buf,int num_args,...)151 static int read_spec_entries(char* line_buf, int num_args, ...) {
152   char **spec_entry, *buf_p;
153   int len, rc, items, entry_len = 0;
154   va_list ap;
155 
156   len = strlen(line_buf);
157   if (line_buf[len - 1] == '\n')
158     line_buf[len - 1] = '\0';
159   else
160     // Handle case if line not \n terminated by bumping
161     // the len for the check below (as the line is NUL
162     // terminated by getline(3))
163     len++;
164 
165   buf_p = line_buf;
166   while (isspace(*buf_p)) buf_p++;
167 
168   // Skip comment lines and empty lines.
169   if (*buf_p == '#' || *buf_p == '\0') return 0;
170 
171   // Process the spec file entries
172   va_start(ap, num_args);
173 
174   items = 0;
175   while (items < num_args) {
176     spec_entry = va_arg(ap, char**);
177 
178     if (len - 1 == buf_p - line_buf) {
179       va_end(ap);
180       return items;
181     }
182 
183     rc = read_spec_entry(spec_entry, &buf_p, &entry_len);
184     if (rc < 0) {
185       va_end(ap);
186       return rc;
187     }
188     if (entry_len) items++;
189   }
190   va_end(ap);
191   return items;
192 }
193 
MapSerialPropertyArea(bool access_rw,bool * fsetxattr_failed)194 bool ContextsSplit::MapSerialPropertyArea(bool access_rw, bool* fsetxattr_failed) {
195   char filename[PROP_FILENAME_MAX];
196   int len = async_safe_format_buffer(filename, sizeof(filename), "%s/properties_serial", filename_);
197   if (len < 0 || len >= PROP_FILENAME_MAX) {
198     serial_prop_area_ = nullptr;
199     return false;
200   }
201 
202   if (access_rw) {
203     serial_prop_area_ =
204         prop_area::map_prop_area_rw(filename, "u:object_r:properties_serial:s0", fsetxattr_failed);
205   } else {
206     serial_prop_area_ = prop_area::map_prop_area(filename);
207   }
208   return serial_prop_area_;
209 }
210 
InitializePropertiesFromFile(const char * filename)211 bool ContextsSplit::InitializePropertiesFromFile(const char* filename) {
212   FILE* file = fopen(filename, "re");
213   if (!file) {
214     return false;
215   }
216 
217   char* buffer = nullptr;
218   size_t line_len;
219   char* prop_prefix = nullptr;
220   char* context = nullptr;
221 
222   while (getline(&buffer, &line_len, file) > 0) {
223     int items = read_spec_entries(buffer, 2, &prop_prefix, &context);
224     if (items <= 0) {
225       continue;
226     }
227     if (items == 1) {
228       free(prop_prefix);
229       continue;
230     }
231 
232     // init uses ctl.* properties as an IPC mechanism and does not write them
233     // to a property file, therefore we do not need to create property files
234     // to store them.
235     if (!strncmp(prop_prefix, "ctl.", 4)) {
236       free(prop_prefix);
237       free(context);
238       continue;
239     }
240 
241     auto old_context = ListFind(
242         contexts_, [context](ContextListNode* l) { return !strcmp(l->context(), context); });
243     if (old_context) {
244       ListAddAfterLen(&prefixes_, prop_prefix, old_context);
245     } else {
246       ListAdd(&contexts_, context, filename_);
247       ListAddAfterLen(&prefixes_, prop_prefix, contexts_);
248     }
249     free(prop_prefix);
250     free(context);
251   }
252 
253   free(buffer);
254   fclose(file);
255 
256   return true;
257 }
258 
InitializeProperties()259 bool ContextsSplit::InitializeProperties() {
260   // If we do find /property_contexts, then this is being
261   // run as part of the OTA updater on older release that had
262   // /property_contexts - b/34370523
263   if (InitializePropertiesFromFile("/property_contexts")) {
264     return true;
265   }
266 
267   // Use property_contexts from /system & /vendor, fall back to those from /
268   if (access("/system/etc/selinux/plat_property_contexts", R_OK) != -1) {
269     if (!InitializePropertiesFromFile("/system/etc/selinux/plat_property_contexts")) {
270       return false;
271     }
272     // Don't check for failure here, since we don't always have all of these partitions.
273     // E.g. In case of recovery, the vendor partition will not have mounted and we
274     // still need the system / platform properties to function.
275     if (access("/vendor/etc/selinux/vendor_property_contexts", R_OK) != -1) {
276       InitializePropertiesFromFile("/vendor/etc/selinux/vendor_property_contexts");
277     } else {
278       // Fallback to nonplat_* if vendor_* doesn't exist.
279       InitializePropertiesFromFile("/vendor/etc/selinux/nonplat_property_contexts");
280     }
281   } else {
282     if (!InitializePropertiesFromFile("/plat_property_contexts")) {
283       return false;
284     }
285     if (access("/vendor_property_contexts", R_OK) != -1) {
286       InitializePropertiesFromFile("/vendor_property_contexts");
287     } else {
288       // Fallback to nonplat_* if vendor_* doesn't exist.
289       InitializePropertiesFromFile("/nonplat_property_contexts");
290     }
291   }
292 
293   return true;
294 }
295 
Initialize(bool writable,const char * filename,bool * fsetxattr_failed)296 bool ContextsSplit::Initialize(bool writable, const char* filename, bool* fsetxattr_failed) {
297   filename_ = filename;
298   if (!InitializeProperties()) {
299     return false;
300   }
301 
302   if (writable) {
303     mkdir(filename_, S_IRWXU | S_IXGRP | S_IXOTH);
304     bool open_failed = false;
305     if (fsetxattr_failed) {
306       *fsetxattr_failed = false;
307     }
308 
309     ListForEach(contexts_, [&fsetxattr_failed, &open_failed](ContextListNode* l) {
310       if (!l->Open(true, fsetxattr_failed)) {
311         open_failed = true;
312       }
313     });
314     if (open_failed || !MapSerialPropertyArea(true, fsetxattr_failed)) {
315       FreeAndUnmap();
316       return false;
317     }
318   } else {
319     if (!MapSerialPropertyArea(false, nullptr)) {
320       FreeAndUnmap();
321       return false;
322     }
323   }
324   return true;
325 }
326 
GetPropAreaForName(const char * name)327 prop_area* ContextsSplit::GetPropAreaForName(const char* name) {
328   auto entry = ListFind(prefixes_, [name](PrefixNode* l) {
329     return l->prefix[0] == '*' || !strncmp(l->prefix, name, l->prefix_len);
330   });
331   if (!entry) {
332     return nullptr;
333   }
334 
335   auto cnode = entry->context;
336   if (!cnode->pa()) {
337     // We explicitly do not check no_access_ in this case because unlike the
338     // case of foreach(), we want to generate an selinux audit for each
339     // non-permitted property access in this function.
340     cnode->Open(false, nullptr);
341   }
342   return cnode->pa();
343 }
344 
ForEach(void (* propfn)(const prop_info * pi,void * cookie),void * cookie)345 void ContextsSplit::ForEach(void (*propfn)(const prop_info* pi, void* cookie), void* cookie) {
346   ListForEach(contexts_, [propfn, cookie](ContextListNode* l) {
347     if (l->CheckAccessAndOpen()) {
348       l->pa()->foreach (propfn, cookie);
349     }
350   });
351 }
352 
ResetAccess()353 void ContextsSplit::ResetAccess() {
354   ListForEach(contexts_, [](ContextListNode* l) { l->ResetAccess(); });
355 }
356 
FreeAndUnmap()357 void ContextsSplit::FreeAndUnmap() {
358   ListFree(&prefixes_);
359   ListFree(&contexts_);
360   prop_area::unmap_prop_area(&serial_prop_area_);
361 }
362